Reader Comments

I don't get it

How do idiots like this get into positions where critical data on *millions* of people gets on backup tapes or other uncrypted?

People like this should be literally thrown in a federal jail for a few years. That'll keep other idiots from taking this kind of stuff home with them

I know this is a royal pain in the arse and I also know it's very costly and difficult to implement but I feel that data should be seperated. There should be about a half a dozen sites around the country with database servers. Each server contains a certain number of people's records. The catch is that these records are both encrypted and that an entire record or file of any given person is fragmented enough that no one single record exists on a single site. Further more no user should ever have access to more than a certain number of records at a time. To go even further not even backup operators get access to the entire system, only a single database on a single server.

Backups are made locally and sent offsite, but no backups are ever in the same location, and they should be kept in maximum securty vaults.

This probably isn't even possible, let alone viable. But that's not the point: The point is how do we keep stupid idiots --or worse: criminals-- like this from walking off federal databases with quite literally *millions* of people's personal information?

Re: I don't get it

This was a person who was not even supposed to have this data outside of work, so it is very likely that they could aggregate it. So all of your plans are for naught as the failure is yet again, a person who has access to the data, malicously or stupidly doing something they should not have.

Ugh

another security suggestion

Why not just put drive lock passwords and on-the-fly encryption on all disks. If the laptop is stolen the theif would have one heck of a time trying to get passed decent encryption and an even harder time with the drive lock password ;)

Short-sighted... and dedicated?

I can't help but notice that you all are complaining about the stupidity of a government worker who took work home. Yes, it was completely short-sighted to not have protection for the data... but the stereotypical government worker would never take work home. It's kind of sad that this ended so badly for the worker.

Re: Short-sighted... and dedicated?

When I was in the service I didn't meet many people willing to take work home. Call my ignorant, but exactly why does anyone need to take a 10,000,000 (current and released service people) name database home? For that matter, why was this person using a laptop in the first place? From the few details I have read, it sounds like this was a normal worker bee who probably did not have a need to travel. So I would assume, the majority of his work was done on the office computer and then he copied the data onto his laptop maybe? Lots of questions have not been answered, and as a vet I want some.

Re: Re: Short-sighted... and dedicated?

Struck me that way too. They say this analyst was working on a project; to me that means probably testing, and for testing purposes, why wouldn't you be using a small subset of this data? We seem to be talking about close to 30,000,000 records here.

on a different note

Data Leak

Nine chances out of ten, the theif was probably a "CrackHead" who doesn't know what he has. More than likely, the laptop went for less than $100.00 and maybe on the desk of some joker not willing to pay top dollar for a new machine. Maybe the increase in the initial reward will get the laptop back where it belongs

Data

The 10,000,000 was an arbitrary number I pulled out of the air, who really knows how many vets, both past and present are in this data base; it could be 10, 20, 30 or many millions more.

When I was in the service, they kept everything about in in the DEFAS database. They could pull up most of your data from date of birth, social, residential history, service locations, you name it. With all that data, I wonder how large this database really was. If the analyst was taking home the project on a CD then 800 mb seems a bit small for all that data. Of course if he was stealing data slowly, that could make a bit more sense, only time will tell.
I love the comment from Chron.com:

Defense officials said the loss is unprecedented and raises concerns about the safety of U.S. military forces. But they cautioned that law enforcement agencies have not found evidence that the stolen information has been used to commit identity theft.

Of course no one has used this data yet most half smart criminals would sit on this data for months if not years before using it.
And look the lawyers jumped on it:

A coalition of veterans groups filed a class-action lawsuit against the federal government on Tuesday, contending that privacy rights were violated and seeking $1,000 in damages for each affected veteran.

$1,000 might barely cover the legal fees most people end up paying in the event of identity theft. I wish they would get a clue and really stick it to them but by doing this so early, any vet who accepts the $1,000 indemnifies the government later.

Innocent worker????

Like one person said the stereotype........wouldn't take it home.
I don't see this as a coincidence, innocent happening, poor
old worker. Why did they take it home? Why was it suddenly
stolen? I would thinik this worker doesn't need to be on leave;
but either behind bars or out on bail under house arrest.
This is highly likely not to be an innocent worker and a random
bunch of thieves. I got a letter, too, and my service is before 1975! They are hiding the total numbers!